In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path<\/p>\n
In sev_dbg_crypt(), the per-iteration transfer length is bounded by
\nthe source page offset (PAGE_SIZE – s_off) but not by the destination
\npage offset (PAGE_SIZE – d_off). When d_off > s_off, the encrypt
\npath (__sev_dbg_encrypt_user) performs a read-modify-write using a
\nsingle-page intermediate buffer (dst_tpage):<\/p>\n
1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16)
\n before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE,
\n the PSP writes beyond the end of the 4096-byte dst_tpage allocation.<\/p>\n
2. The subsequent memcpy()\/copy_from_user() into
\n page_address(dst_tpage) + (d_off & 15) of ‘len’ bytes overflows
\n by up to 15 bytes under the same condition.<\/p>\n
Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE –
\nthe PSP is instructed to write round_up(4097, 16) = 4112 bytes to
\na 4096-byte buffer.<\/p>\n
Fix by also bounding len by (PAGE_SIZE – d_off), the same check that
\nsev_send_update_data() already performs for its single-page guest
\nregion.<\/p>\n
==================================================================
\n BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993\/0xd10 [kvm_amd]
\n Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test\/228214<\/p>\n
CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp–5ce9b0c48211-dbg #156 PREEMPTLAZY
\n Tainted: [U]=USER, [W]=WARN
\n Hardware name: Google Astoria\/astoria, BIOS 0.20250817.1-0 08\/25\/2025
\n Call Trace:<\/p>\n
dump_stack_lvl+0x54\/0x70
\n print_report+0xbc\/0x260
\n kasan_report+0xa2\/0xd0
\n kasan_check_range+0x25f\/0x2c0
\n __asan_memcpy+0x40\/0x70
\n sev_dbg_crypt+0x993\/0xd10 [kvm_amd]
\n sev_mem_enc_ioctl+0x33c\/0x450 [kvm_amd]
\n kvm_vm_ioctl+0x65d\/0x6d0 [kvm]
\n __se_sys_ioctl+0xb2\/0x100
\n do_syscall_64+0xe8\/0x870
\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53<\/p>\n
The buggy address belongs to the physical page:
\n page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb
\n memcg:ff11000112827d82
\n flags: 0x1400000000000000(node=1|zone=1)
\n raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000
\n raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82
\n page dumped because: kasan: bad access detected<\/p>\n
Memory state around the buggy address:
\n ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\n ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\n >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
\n ^
\n ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
\n ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
\n ==================================================================
\n Disabling lock debugging due to kernel taint<\/p>\n
[sean: add sample KASAN splat, Fixes, and stable@]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path<\/p>\n
In sev_dbg_crypt(), the per-iteration transfer length is bounded b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14872","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14872"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}